EUVD-2026-102526
GHSA-pxwm-j3xc-rxqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious AMS module with bit-7 effect bytes
-
DeliveryDeliver file to victim via download or attachment
-
ExploitVictim opens file in libmodplug consumer
-
ExecutionReadAMS2() reads past heap buffer
-
ImpactProcess crash / adjacent heap memory read
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-supplied AMS (Velvet Studio) module file using an application that links libmodplug 0.8.9.1 or earlier; the crafted file must specifically keep bit 7 set in its pattern effect bytes to drive the ReadAMS2() decoder past the input buffer. Limiting factors: the attack vector is local (AV:L) and requires passive user interaction (UI:P) - there is no network-triggerable path and no exploitation against a default configuration without a user loading the file. No authentication or privileges are needed on the part of the attacker (PR:N), but delivery and victim action are prerequisites, and the practical outcome is a crash of the consuming process rather than confirmed data exfiltration or code execution. |
| Impact | This is a moderate, client-side reliability/DoS issue rather than a high-urgency priority. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and is driven almost entirely by availability impact (VA:H) - the realized effect is a crash of any libmodplug consumer, not code execution. Note a conflict worth stating explicitly: the description and the 'Information Disclosure' tag imply the attacker can 'read adjacent heap memory' (CWE-125), yet the CVSS confidentiality impact is VC:N/C:N - meaning the OOB read is treated as causing a crash rather than leaking data back to the attacker. Verify with the reporter whether any read data is actually exfiltrated or only triggers a fault. No EPSS score, KEV listing, or SSVC decision data was provided in the input; absence of these is not evidence of safety but means exploitation probability cannot be quantified here. A detailed technical write-up (hackmd) and the exact vulnerable source lines are public, lowering the bar to reproduce, but there is no indication of active exploitation. The local attack vector plus required user interaction (victim must open a crafted AMS file) substantially limit real-world impact - this is not a remotely-wormable flaw. |
| Exploit ScenarioDerived | An attacker crafts a malicious AMS module file whose pattern effect bytes keep bit 7 set and distributes it (email attachment, download, embedded in a media library). When a victim opens or previews the file in any application that links libmodplug (media players, desktop sound frameworks), the ReadAMS2() decoder reads past the input heap buffer and crashes the host process. A public technical write-up describing the bug and the exact vulnerable code path exists, making reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Crafted AMS (Velvet Studio) module files can crash any application that uses libmodplug 0.8.9.1 or earlier by triggering a heap-based out-of-bounds read in CSoundFile::ReadAMS2(). The attacker must deliver a specially formed AMS file whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer; the victim must then open or process the file, and no authentication is required. The issue is a local, client-side denial-of-service (CVSS 6.8) with no confirmed confidentiality or integrity impact, and no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch for CVE-2026-111271 has been identified at time of analysis; monitor the upstream libmodplug repository (https://github.com/Konstanty/libmodplug) and the VulnCheck advisory for a fixed release beyond 0.8.9.1. Until a patch is available, avoid opening or processing untrusted AMS (Velvet Studio) files with any libmodplug-based application, and where feasible configure file-type filters or extension blocking to reject .ams files. If AMS support is not required, consider disabling or removing that decoder path from the consuming application, recognizing that this may break legitimate module playback. Process untrusted files in a sandboxed or low-privilege environment to limit the impact of a crash; this does not fix the underlying out-of-bounds read and may introduce performance or compatibility trade-offs. Application vendors that bundle libmodplug should track upstream fixes and rebuild their products once a patched version is released, while compile-time hardening such as ASLR and heap canaries can raise exploitation difficulty but do not eliminate the defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read in the AMS decoder of libmodplug, an open-source library that decodes many tracker module formats (MOD, S3M, XM, IT, AMS, and others). The vulnerable routine is CSoundFile::ReadAMS2() in src/load_ams.cpp (see the referenced code at lines 509-537 in commit d1b97ed0020bc620a059d3675d1854b40bd2608d), which parses pattern effect bytes from an AMS file. When those effect bytes repeatedly keep bit 7 set, the decoder advances its read pointer beyond the allocated input buffer and reads adjacent heap memory. Because the malformed data is processed during file parsing, the out-of-bounds access can crash the consuming process. Although the description notes the possibility of reading adjacent heap memory, the assessed impact vector rates only availability (A:H) with no confidentiality or integrity impact, so the practical outcome is a denial-of-service via crash rather than confirmed data exfiltration.
Know when Libmodplug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Victim must open a crafted file (AV:L, UI:R); no privileges needed (PR:N); realized impact is a process crash (A:H) with no confirmed disclosure or integrity loss (C:N/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Libmodplug
View allInteger overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmo
Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSou
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before th
Crafted ABC Music Format files cause uncontrolled resource consumption in libmodplug up to and including 0.8.9.1, where
Exploit-DB